diff --git a/conf/insideout/sip_profiles/external.xml b/conf/insideout/sip_profiles/external.xml
index be38318432..f021a4c3c6 100644
--- a/conf/insideout/sip_profiles/external.xml
+++ b/conf/insideout/sip_profiles/external.xml
@@ -48,6 +48,7 @@
     <param name="auth-calls" value="false"/>
     <param name="rtp-timeout-sec" value="1800"/>
     <param name="inbound-late-negotiation" value="true"/>
+    <param name="inbound-zrtp-passthru" value="true"/>
     <!--
         DO NOT USE HOSTNAMES, ONLY IP ADDRESSES IN THESE SETTINGS!
     -->
diff --git a/conf/insideout/sip_profiles/internal-ipv6.xml b/conf/insideout/sip_profiles/internal-ipv6.xml
index e433da1425..b9907a78ad 100644
--- a/conf/insideout/sip_profiles/internal-ipv6.xml
+++ b/conf/insideout/sip_profiles/internal-ipv6.xml
@@ -69,6 +69,9 @@
     <!-- Let calls hit the dialplan before selecting codec for the a-leg -->
     <param name="inbound-late-negotiation" value="true"/>
 
+    <!-- Allow ZRTP clients to negotiate end-to-end security associations -->
+    <param name="inbound-zrtp-passthru" value="true"/>
+
     <!-- this lets anything register -->
     <!--  comment the next line and uncomment one or both of the other 2 lines for call authentication -->
     <!-- <param name="accept-blind-reg" value="true"/> -->
diff --git a/conf/insideout/sip_profiles/internal.xml b/conf/insideout/sip_profiles/internal.xml
index 61263f03dc..e406cd5e72 100644
--- a/conf/insideout/sip_profiles/internal.xml
+++ b/conf/insideout/sip_profiles/internal.xml
@@ -104,6 +104,9 @@
     <!-- Let calls hit the dialplan before selecting codec for the a-leg -->
     <param name="inbound-late-negotiation" value="true"/>
 
+    <!-- Allow ZRTP clients to negotiate end-to-end security associations -->
+    <param name="inbound-zrtp-passthru" value="true"/>
+
     <!-- this lets anything register -->
     <!--  comment the next line and uncomment one or both of the other 2 lines for call authentication -->
     <!-- <param name="accept-blind-reg" value="true"/> -->
diff --git a/conf/sbc/sbc_profiles/external.xml b/conf/sbc/sbc_profiles/external.xml
index 1cb91e8dab..0f15159f58 100644
--- a/conf/sbc/sbc_profiles/external.xml
+++ b/conf/sbc/sbc_profiles/external.xml
@@ -49,6 +49,7 @@
     <param name="auth-calls" value="false"/>
     <param name="rtp-timeout-sec" value="1800"/>
     <param name="inbound-late-negotiation" value="true"/>
+    <param name="inbound-zrtp-passthru" value="true"/>
     <!--
         DO NOT USE HOSTNAMES, ONLY IP ADDRESSES IN THESE SETTINGS!
     -->
diff --git a/conf/sbc/sbc_profiles/internal-ipv6.xml b/conf/sbc/sbc_profiles/internal-ipv6.xml
index e433da1425..b9907a78ad 100644
--- a/conf/sbc/sbc_profiles/internal-ipv6.xml
+++ b/conf/sbc/sbc_profiles/internal-ipv6.xml
@@ -69,6 +69,9 @@
     <!-- Let calls hit the dialplan before selecting codec for the a-leg -->
     <param name="inbound-late-negotiation" value="true"/>
 
+    <!-- Allow ZRTP clients to negotiate end-to-end security associations -->
+    <param name="inbound-zrtp-passthru" value="true"/>
+
     <!-- this lets anything register -->
     <!--  comment the next line and uncomment one or both of the other 2 lines for call authentication -->
     <!-- <param name="accept-blind-reg" value="true"/> -->
diff --git a/conf/sbc/sbc_profiles/internal.xml b/conf/sbc/sbc_profiles/internal.xml
index 8263a82668..3081052c88 100644
--- a/conf/sbc/sbc_profiles/internal.xml
+++ b/conf/sbc/sbc_profiles/internal.xml
@@ -110,6 +110,9 @@
     <!-- Let calls hit the dialplan before selecting codec for the a-leg -->
     <param name="inbound-late-negotiation" value="true"/>
 
+    <!-- Allow ZRTP clients to negotiate end-to-end security associations -->
+    <param name="inbound-zrtp-passthru" value="true"/>
+
     <!-- this lets anything register -->
     <!--  comment the next line and uncomment one or both of the other 2 lines for call authentication -->
     <!-- <param name="accept-blind-reg" value="true"/> -->
diff --git a/conf/vanilla/sip_profiles/external.xml b/conf/vanilla/sip_profiles/external.xml
index 8176d9b23f..4f18e84be7 100644
--- a/conf/vanilla/sip_profiles/external.xml
+++ b/conf/vanilla/sip_profiles/external.xml
@@ -57,6 +57,7 @@
     <param name="nonce-ttl" value="60"/>
     <param name="auth-calls" value="false"/>
     <param name="inbound-late-negotiation" value="true"/>
+    <param name="inbound-zrtp-passthru" value="true"/>
     <!--
         DO NOT USE HOSTNAMES, ONLY IP ADDRESSES IN THESE SETTINGS!
     -->
diff --git a/conf/vanilla/sip_profiles/internal-ipv6.xml b/conf/vanilla/sip_profiles/internal-ipv6.xml
index 2dd3842649..18274faa4f 100644
--- a/conf/vanilla/sip_profiles/internal-ipv6.xml
+++ b/conf/vanilla/sip_profiles/internal-ipv6.xml
@@ -70,6 +70,9 @@
     <!-- Let calls hit the dialplan before selecting codec for the a-leg -->
     <param name="inbound-late-negotiation" value="true"/>
 
+    <!-- Allow ZRTP clients to negotiate end-to-end security associations -->
+    <param name="inbound-zrtp-passthru" value="true"/>
+
     <!-- this lets anything register -->
     <!--  comment the next line and uncomment one or both of the other 2 lines for call authentication -->
     <!-- <param name="accept-blind-reg" value="true"/> -->
diff --git a/conf/vanilla/sip_profiles/internal.xml b/conf/vanilla/sip_profiles/internal.xml
index 1ba2c57427..0f4cabe32d 100644
--- a/conf/vanilla/sip_profiles/internal.xml
+++ b/conf/vanilla/sip_profiles/internal.xml
@@ -222,6 +222,9 @@
     <!-- Let calls hit the dialplan before selecting codec for the a-leg -->
     <param name="inbound-late-negotiation" value="true"/>
 
+    <!-- Allow ZRTP clients to negotiate end-to-end security associations -->
+    <param name="inbound-zrtp-passthru" value="true"/>
+
     <!-- this lets anything register -->
     <!--  comment the next line and uncomment one or both of the other 2 lines for call authentication -->
     <!-- <param name="accept-blind-reg" value="true"/> -->
diff --git a/src/mod/endpoints/mod_sofia/conf/sofia.conf.xml b/src/mod/endpoints/mod_sofia/conf/sofia.conf.xml
index 9acbe6d916..30d8063a67 100644
--- a/src/mod/endpoints/mod_sofia/conf/sofia.conf.xml
+++ b/src/mod/endpoints/mod_sofia/conf/sofia.conf.xml
@@ -266,6 +266,9 @@
         <!-- Let calls hit the dialplan before selecting codec for the a-leg -->
         <param name="inbound-late-negotiation" value="true"/>
 
+        <!-- Allow ZRTP clients to negotiate end-to-end security associations -->
+        <param name="inbound-zrtp-passthru" value="true"/>
+
         <!-- this lets anything register -->
         <!-- comment the next line and uncomment one or both of the other 2
              lines for call authentication -->